Despite mounting concerns about worst-case scenarios, warnings about the state of critical infrastructure to withstand attacks are leading to changes